Archive for the ‘General’ Category

3D printing keys for Protec2

Saturday, September 23rd, 2023

This story is based on the work from Reinder Stegen, in which the Protec2 was reverse engineered and scripts for parametric key generation are written. Reinder worked with James Wah for the parametric webblification. As in, a free to use online webgenerator for all your Protec2 key needs. To get the keys to the real world, one just needs a good 3D printer.

3D printing keys has been around for at least a decade, from 3D printing scrips like AutoKey3D by Chris Holler to printing many high security keys. Modeling and printing keys gives unique understanding of the underlying principles of the locking mechanisms. I, myself, wouldn’t have understood Kromer protector, Bowley Rorasera, and Fichet F3D as well without modeling the keys.

While 3D printing keys can be a strong attack, the bitting of the key needs to become known to an attacker beforehand. If this attack is within your threat model, please invest into key control. I.e. to keep track of the locks and keys in your system.

The challenge

A set of nine Abloy PL340 locks caught my attention as it was sold as a lockpicking challenge. As in, the seller didn’t have the correct keys, but included keys from the same series. Where the challenge is to open the locks. I chose to work with Reinder to decode one, and 3D print the keys for the rest of the set.

The PL340 are beefy padlocks of around 55*50*25mm, very much excess for any normal consumer applications. While we like them for securing Peli cases, they’ll work fine on your motorcycle or shipping container as well.

The key making process started by decoding the several non-working keys in the package keys. While five cuts were shared between the keys, it wasn’t enough to determine what the keys should be. One lock was disassembled and the disks were decoded according to the pictures in the Protec2 white paper by Han Fey. (Reinder has published a better chart on 22nd of September 2023)

The Protec2 has eleven disks, of which the fourth and eleven are zero disks. All code disks have two true gates, except for a six with one true gate. We see four disks with more than two true gates, which means they are mastered and accept a key with either cuts on it.

I’ve opted to use Python to create a list of all possible keys in this system instead of using pen and paper. After I had a working solution with many nested loops, I found the function product in the itertools package to generate a list of solutions in fewer lines of code. The code below generates and prints the valid keys from a list of lists with possible bittings.

# Quick script to get all possible keys from a single master keyed lock.
# 20230730 Jan-Willem CCBY4.0 Toool NL

import itertools

# The key codes is a list of list of ascii characters. 
key_code = [['0'],['5'],['4'],['6'],['3','5'],['1','6'],['1','3'],['0'],['5','6'],['6'],['1']]
keys = list(itertools.product(*key_code))

for key in keys:

This script should work for most key systems. For me, it generated the sixteen valid keys of this master keyed system. With Reinder’s online generator, I’ve generated the files. As I lack a printer capable of printing these, I used the 3D printing service from JLCPCB. Reinder had good experience with Imagine Black, so that was my starting point as well.

Reinder’s tool for generating the keys isn’t widely shared, yet. He has shared a video in which several more 3D printed keys are showcased, including a few which work better than the online generated keys. Several other scripts (By NVX, and bgrydon) are available online, but they don’t work as well as this work.

Uploading the models it to the service was quite tedious. Not only does the material, finish, and customs description need to be filled in for each print, QA was quite picky, and rejected the files several times. After some touch ups in Meshmixer, the keys are ordered. 3D printing keys was very affordable.

The prints came in after a couple of weeks and look great. As the print doesn’t have a captive ball bearing, I’ve removed one from a non-functioning key. Sadly, none of the keys worked of the first print run. After double-checking the data, I’ve found a translation mistake. One disk was flipped in the picture, where a disk five becomes a three.

After going through the process a second time, the keys opened the lock I decoded. Possibly a bit more surprising, two keys worked on all other locks as well. So these are the master keys of a system bigger than these nine locks.

While it’s a great success, and defeating this system with 3D printing, I think we can do much more with this locking system. I’ll likely revisit the work of Matt Smith, to attempt to pick it, or at least try to find a better way of decoding the locks.

To settle one curiosity, I’ve commissioned new prints generated by Reinder in several materials. These have a captive ball. From left to right, we have: Imagine black, 9000R Resin, 8228 Resin, 8001 Resin, 3201PA-F Nylon, 316L Stainless.

All the plastic keys were dimensionally correct and opened the lock. Of course, the engineering resins work much smoother and are generally stronger. The 8228 seems to be very good, except for the ugly color 🙂

So, what about the metal key? While it is amazing we can have these parts fabricated for €8 per key, the dimensions aren’t there yet. The key is slightly oversized and doesn’t fit the keyway. Of course, you can order keys with several different scaling factors, but it’ll be expensive, whereas the resin prints work well and are relatively cheap. In the end the resin keys are around €2 each, and I’ve spent about €200 on the whole project.

While it’s exciting to ‘defeat’ Protec2 locks with this attack, it’s more a showcase of skill and dedication of people in the locksport community. Thanks, Reinder and James, for allowing me to use this work.

This text and the pictures are CCBY4.0 Jan-Willem Markus, Toool Blackbag.
The copyright of the key generator is with Reinder Stegen and James Wah.

Cutaways, and lever locks

Monday, September 11th, 2023

When we teach lockpicking we usually revert to schematics of locks, and different models for demonstrating the functionality of locks. Usually required as the core functionality is well hidden, and not often observable in action. Multiple skilled machinists have made cutaway locks for the purpose of demonstrating the inner workings of real locks.

At one cutaway themed evening, we had over 50 unique cutaways on the table. From all brands and mechanisms. Some of which even the pins themselves were cutaway.

On an evening with impressioning, a member asked for some blanks to practice with. The call was answered by the keys below. Sadly, it’ll be very hard to find a corresponding lock for the key blanks, as in Europe we have thousands of unique keyways. Even though they all look a-like.

On another evening, we delved deep in lever locks, from your classic Chubb locks to high-end safes. A boroscope was brought as to try to decode some locks by belly reading the levers. E.g. to observe the scratches on the levers and determining the length of the butting making the scratches.

The WE30C also made its appearance, one night. The lock was used on pay phones, and is remarkably hard to lockpick due to the lever blocking system, shown in the top right. As torque is applied, the blocking system engages with the levers, making all levers bind up before the lever tests the gate.

Lips shared access

Wednesday, July 5th, 2023

Locks don’t have to be hard to pick to be interesting, and a Lips lock Jos loaned me is a fine example of that.

Lately I’ve been drawn to picking lever locks, as they have that nice “Skyrim” vibe. You can get a long way with just some bent wires. Knowing that, Jos brought this nice Lips lock to a Toool meetup, and I got to play with it a little.

Picking it is pretty straightforward, as there are no false gates on the lever, and no curtain. The pin in the keyway does make navigation a bit awkward, but all in all it’s not hard to pick. 

Things get more interesting when you take a closer look at the lock.

First of all, it’s a Lips lock. Lips is a Dutch lock manufacturer that was founded in Dordrecht in 1871 by Jacobus Lips. In 1971 it became part of Chubb, and since 2000 it’s part of the Assa Abloy group.

The second name on the lock is P.G.E.M. The P.G.E.M. (or Provinciale Gelderse Energie Maatschappij) was a utility company delivering electricity and gas to the whole province of Gelderland in The Netherlands. Every Dutch province used to have its own utility company. It was owned by the province, and the local municipalities.

In the 1990’s the Dutch government decided all the utility companies had to be privatized, and P.G.E.M. became part of Nuon (which is now a part of Vattenfall).

Below P.G.E.M. are the letters LS, that stand for Laagspanning or Low Voltage. PGEM used these locks to secure electrical substations, and LS indicates this particular lock was used on a low voltage substation. The other side of the lock tells us more about this.

Here we see “Onderstation Woudhuis” written in pencil. Onderstation Woudhuis is a substation located in the city of Apeldoorn.

The double keyway is a striking feature which reminds of dual custody locks, only this isn’t that. It’s shared access, where only one of both keys is required to open the lock. This becomes clear when the faceplate is removed.

This seems to be a form of master keying without having to need to add extra gates to the levers, which would compromise the security of the lock. 

Every lever has two cuts at the bottom. A closer look at two of the levers shows how different cut heights make it possible to open the lock with two different keys.

Moral of the story: locks are fun in so many ways.


After posting the original blog, a good friend in the UK shared a page with the patent of the ‘Mastership’ two keyhole lock from 1889.

What happens at a Toool meetup?

Wednesday, May 31st, 2023

In the current Tool rhythm, we have one meetup a week. Both the Amsterdam and Eindhoven meetups are Bi-weekly, where we planned to have one meetup a week. We come together to discuss lock topics, compete in the Toool competition, and generally have fun picking locks.

In this post, I’d like to share pictures topics and projects that have come across at Toool meetups.

A locked coin safe was brought to the meeting. Due to the construction of the box, the lock was a very difficult to put torque on with a turning tool. We succeeded in opening the lock several times, and had great fun picking the lock in literally seconds with an electronic pick.

Once in a while, we receive donations from community members. This Sparrows vault was donated to us with the request for an upgrade to the lock, as the original served not enough of a challenge. We complied, and mounted a Kaba Mas X0 Electronic lock on the Vault.

Everyone has a go-to pickset, one which is a mix of everything. We also bring Sunday’s best to dedicated sets. For example, Moki makes great picksets, which are even better with homemade handles. Or a shiny Multipick set, be it dimple or a dual-gauge set designed by Christina Palmer. Where the only part staged about the photo is to have all the sets neatly displayed.

We went to the Association des Crocheteurs de France conference in December 2022, and brought back a few tools and picks from France. We attempted to pick the Polox-5, and Fichet F3D. Both attempts made possible by the incredible work of Nitiflor, who designed and 3D printed these picks.

Jos brought a suitcase with Chinese locks, which was gifted to him for organizing LockCon 2016. At the time, these locks were unobtainable, and information sparse. The mechanisms are very intricate with 50-element wafer locks, and cores with continuous rotation similar to the Yuema 750, an implementation we have yet to see used in Europe.

If this blog sparked interest in lockpicking, or if you have been picking and would like to join a meetup, please contact us. We are always welcome to new people, be it to teach the basics or to share advanced tricks.

Cutaway locks, why put in the effort?

Sunday, April 16th, 2023

In a previous blog post, I’ve written about Qikom’s cutaways. Whereas, this post is a tangent on why we would like to see more cutaways made and the knowledge shared.

When we teach beginners, and show them a unique lock, often they can’t imagine what happens in the lock. As all they can see is the outside. To illustrate this, let’s play a short game with a Fichet 787. The key looks quite interesting, as it has half a dozen cutouts on each side. It’s not symmetrical, and can only be inserted in the keyway in one direction. You feel a spring pushing against the key, but at rotation it seems to be like any other lock.

If you haven’t seen this lock before, take a moment to imagine what the internals are like.

Fichet 787. CC-BY-4.0 Jan-Willem, Toool Blackbag

It’s quite obvious where I’m going with this. There can be almost anything inside the shiny cylinder. It will be very difficult to find the solution without taking it a part, or looking at a diagram. The cutaway, like the one from Qikom below, shows the internals from the lock. Reducing the guess work over a picture of the parts.

Qikom Fichet 787 Cutaway
Qikom Fichet 787 Cutaway; The interaction between the lever pack and the gears.
Qikom Fichet 787 Cutaway; The lock is open.

Is it anything like you imagined it to be?

What does the 787 do? The Fichet 787, is a push lever lock. Where the push action allows the lateral movement of the levers to rotate a set of gears to the opening position. The sidebar is a passive element that checks if the gears are all aligned. With the correct key, the cylinder moves inwards, clears a blocking element, and is able to rotate. At the same time, the key is trapped by two half circle disks.

It is quite possible you have seen this lock before, as it has been around for decades. I’ve learned about the lock in 2018, and recently expanded the knowledge at the Association des Crocheteurs de France lock conference in December 2022. I’ve learned the dovetail, which connects the cam to the core, is a fairly recent addition that prevents a (partially) destructive attack, for example.

French locks are my favorite weird lock designs, where Fichet is king. The ingenuity is admirable, with many clever ways to solve the same problem…

Gorgeous cutaway photos from Qikom

Wednesday, January 25th, 2023

Qikom, lockpicker from France, created gorgeous locks cutaways and shared the images online. I believe cutaways to be very useful for understanding intricate lock designs. Where a good cutaway allows us to observe the elements of the lock while still functioning as normal.

Qikom is an associate professor in mathematics and computer science. Who got interesting in lock picking a little before 2000 after reading R. Feynman (the physicist) autobiography. Like many pickers, he is interested in the “puzzle” aspect of locks, and making a working cutaway is another kind of puzzle. Furthermore, he added, to spend more time making cutaways than picking locks!

You can find Qikom’s complete cutaway collection at: The pictures are licensed under CC BY-NC-SA 4.0.

Screenshot from Qikom’s website as of January 2023. CC BY-NC-SA 4.0

I’ve asked Qikom for tips on making great cutaways. He says about his cutaway strategy:

“I don’t have a well-defined strategy when planning a new cutaway. I know people start by making a 3D model of the lock to plan the cuts, but I don’t bother. In many of the locks I’ve cut, the cutting plan isn’t all that complex, and I try to set things up, so I can adjust things incrementally. One important thing I do, is to never cut a lock on the same day that I come up with the cutting plan, to get some time to think about it.

I usually try to have at least 2 identical locks to cut, and I consider one of them to be expendable. When everything works, I can sell / trade the second one, and if not, I get to correct any mistake on the second try. A couple of times, I badly failed twice, but could salvage enough parts to get the third attempt.
But there are still some locks waiting because I wouldn’t want to mess them up.

I’ve made several embarrassing goofs along the way, but none of them would have been prevented by that! The graveyard includes several Robur, Rosengrens, Abloy, Fontaine, and Fichet… 🪦 I’ve only attempted cutting an F3D when I got a couple of broken ones. This was a good idea, because the first 3 attempts were failures.

But there are still some locks waiting because I wouldn’t want to mess them up. Including the Emhart.”

Qikom often sells his cutaways online to partially fund the hobby. If you have interesting in these locks, or have a few spares that would work as a cutaway, consider contacting Qikom at

Wooden lock; Binding order demo

Sunday, May 23rd, 2021

In 2019 Jan-Willem build a binding order demo out of laser cut wood.
In this post we would like to share the project with the rest of the world.

Binding order is the order in which the pins bind in a lock. This is mostly due to the manufacturing tolerances but can have other causes. This concept is hard to grasp for a new lockpicker and is one of those ‘You’ll get it when you see it’ concepts. When teaching lockpicking it is common to hear: ‘I have been pushing down this pin and it doesn’t want to stay down.’ This tool can be used to demonstrate why the pin did not want to stay put.

This demo is certainly not ‘the’ solution. It is just a fair attempt that works for us. It will make the explanation better by adding both the visual and touch to the explanation. The participants can play with the board and feel the effect of binding and what the effect is of using light or strong tension.

For reference: The board is about the size of an A4 piece of paper. The base is crafted from three layers of 3mm plywood. The core is a single sheet and the pins are three or four layers, depending on the feel you prefer. Each pinhole in the base/core has a different size and different offset. All of the pins are a different size er well. This gives plenty of options to change the binding order.

We used the demo in lockpicking villages across the globe. We have found that it helps the explanation immensely when encountering language barriers. Video link to how you can use the binding order demo:

The binding order in this model can be quite subtle. It would great to have another with extreme exaggerated binding order also a smaller, 3D printed version, would be great to have. A bit of paint will not hurt either.

CC-BY-4.0 Jan-Willem Markus Toool Blackbag.

Album for storing a pin collection

Thursday, March 11th, 2021

In 2019 Jan-Willem started with am odd collection. Not the locks, nor the keys, just the pins from a pin tumbler. Pins are in a lock and make them function. However, the pins are only observable when the owner decides to gut the lock or create a cutaway. The idea was simple: Create a collection/archive of pin tumbler pins and their keys. This required a proper way to store the pins.

To store the pins many different boxes have been tried. After many failed attempts Jan-Willem stumbled upon a hobby not to dissimilar from our own: coin collecting! The value of one €2 coin is just €2 to a consumer. While the collector is looking for a 1st edition misprint from Monaco, and not just any coin.

Coins are often stored in albums, either with or without protection. The lowest quality coins protection are two pieces of plastic film and a cardboard cutout. Often glued or stapled together. While the high end coins are with a certificate sealed in an acrylic case. Leuchtturm makes coin boxes in between the two, and at a reasonable price and the inserts are DIY, lasercut acrylic.

First attempt with Leuchtturm boxes.

To store these boxes it was decided to use business card holders, this did not go as plan and required custom holders. First made from acrylic and the second version from wood. Fifty sets of pins are created and thirty are added to the album. This is where the project was stuck for a year.

Pins in album v1

Last week was a good time to continue this project. A proper pleader album was bought. And the pins are added.
This is the result this far:

Abus E90 pins in a box.
Leuchtturm album.
Demonstrating how the Leuchtturm album is used to store pins.
Pins neatly stored in the album.

The album has 48 pins and about 30 more sets are ready to be archived. Acrylic is ordered and the inserts will be created when a lasercutter is accessible again. The photos will be published here on Blackbag. For now you can find one key a day on twitter:

The coin boxes, album, and inserts are sold under the name Leuchtturm and Lighthouse. These boxes are available on eBay. Link to a Dutch web shop:

The files are available under creative commons, share alike with attribution, commercial use is allowed.

Lockpicks for Hackerspaces

Tuesday, December 3rd, 2019

Post by: Jan-Willem
I’ve recently acquired ~20kg lockpicks, 4000 lockpicks. These where sold by a scrap metal dealer on eBay. As why he had them I can only guess. He did well for not scrap these. The picks are a bit rusty and need work to be useable. As you can imagine cleaning them all by myself will not be fun. There for I decided to sell most of them and give some away. (Yes, this project is not what a sane person would attempt.)

I’ve sold bags of 500g at LockCon. Most will be used at lockpicking villages around Europe. With the remaining picks I’ve created grabbags of about 250gram (50 picks) for the Dutch Hackerspaces. Because every Hackerspace needs lockpicks.

Lockpicks, ~4000 of them!
Lockpicks packed and labelled. Ready to be shipped by Hackermail (Inter-hackerspace delivery service)

The full story can be found on: Happy picking!

East German secret policy and lockpicking

Thursday, July 11th, 2019

More than 12 years ago, Oli Diederichsen wrote a book about impressioning. It had quite an effect and nowadays we have impressioning championships in which working keys are filed in amazing times.

And now, Oli has written a new book (called “Stasi Secret Service Tools: Die geheimen Schlossöffnungswerkzeuge der Abteilung VIII“), about the former East German secret service and their research into locks and lock opening. They made combs (called “heavenly key”) and special opening tools for Trabant cars, the only car a normal person in Eastern Germany could buy. But they were also interested in locks from other places, including high security locks.

At the previous LockCon, Oli already showed his ongoing work including some really interesting pictures of the Stasi tools. The book is available in German only.